How to Use Controller Middleware in Laravel: Simple Guide

In Laravel, you use $this->middleware() inside a controller's constructor to apply middleware to its routes. This method lets you specify middleware globally for the controller or limit it to certain methods using only or except options.

Syntax

Use $this->middleware('middlewareName') inside the controller's constructor to apply middleware. You can restrict middleware to specific methods with only or exclude methods with except.

• middlewareName: The name of the middleware registered in app/Http/Kernel.php.
• only: Apply middleware only to listed methods.
• except: Apply middleware to all methods except listed ones.

php

public function __construct()
{
    $this->middleware('auth'); // Apply to all methods

    // Apply only to index and show methods
    $this->middleware('log')->only(['index', 'show']);

    // Apply to all except create and store
    $this->middleware('verified')->except(['create', 'store']);
}

Example

This example shows a controller applying the auth middleware to all its methods, and the log middleware only to index and show methods. It demonstrates how middleware controls access and logging.

php

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;

class PostController extends Controller
{
    public function __construct()
    {
        $this->middleware('auth');
        $this->middleware('log')->only(['index', 'show']);
    }

    public function index()
    {
        return 'Showing all posts';
    }

    public function show($id)
    {
        return "Showing post with ID: $id";
    }

    public function create()
    {
        return 'Create post form';
    }

    public function store(Request $request)
    {
        return 'Storing new post';
    }
}

Output

When accessing any method, the user must be authenticated due to 'auth' middleware. Additionally, 'log' middleware runs only on 'index' and 'show' methods.

Common Pitfalls

Common mistakes include:

• Forgetting to call $this->middleware() inside the constructor.
• Using middleware names not registered in app/Http/Kernel.php.
• Misusing only and except arrays causing middleware to apply incorrectly.
• Trying to apply middleware outside the constructor.

php

<?php

// Wrong: middleware called outside constructor
public function index()
{
    $this->middleware('auth'); // This will not work
    return 'Index page';
}

// Right: middleware inside constructor
public function __construct()
{
    $this->middleware('auth');
}

Quick Reference

Usage	Description
$this->middleware('auth')	Apply 'auth' middleware to all controller methods
$this->middleware('log')->only(['index', 'show'])	Apply 'log' middleware only to 'index' and 'show' methods
$this->middleware('verified')->except(['create', 'store'])	Apply 'verified' middleware to all except 'create' and 'store' methods
Middleware in constructor	Middleware must be registered inside the controller constructor
Middleware name	Must match the key in app/Http/Kernel.php

Key Takeaways

Use $this->middleware() inside the controller constructor to apply middleware.

Restrict middleware to specific methods with only() or exclude with except().

Middleware names must be registered in app/Http/Kernel.php to work.

Do not call middleware methods outside the constructor.

Controller middleware helps organize request filtering and security cleanly.